If you host with us or hold a retainer, we do, and the commitment is specific: security patches are applied within 48 hours of release. That covers Umbraco itself and the components around it. If you are asking this question because you genuinely do not know who patches your current site, treat that as the answer: nobody does. Patching is the single most common gap we find when we take over sites, because it is invisible work that no one notices until the day it matters. It is included in all our hosting plans, from £99 a month for managed Umbraco Cloud, and in every retainer tier from £500 a month, not sold as an extra.
Every unpatched CMS on the internet is on a list somewhere. When a vulnerability is published, automated scanners start hunting for sites that have not applied the fix within hours, not weeks. So the real question is not whether patches exist, it is whether anyone is contractually responsible for applying yours, and how fast.
Within 48 hours of a security patch being released, it is applied to every site we manage. That is a standing commitment across our hosting plans and retainers, not a best-efforts aspiration. We watch the announcements so you do not have to, and patching happens whether or not you have asked for anything else that month.
Patching is invisible when it works and catastrophic when it does not, which makes it exactly the kind of work that falls through gaps between suppliers. The classic setup: the site was built by an agency that has since moved on, hosting is with a generic provider who manages the server but not the application, and each assumes the other handles CMS updates. The result is a site nobody patches, discovered either by an audit or by an attacker. When we take over sites in this state, months or years behind on patches is normal, not exceptional.
Patches only exist for supported versions. Umbraco 13 security support ends on 14 December 2026; after that, no patching service can protect a 13 site, because there will be nothing to apply. If your site is on 13, patching discipline and an upgrade plan are two halves of the same protection.
If you cannot say with certainty who patched your site last and when, that is worth fixing this month, not someday. Ask your current supplier the question directly, and if the answer is vague, ask us instead.
Tell us what you're working on and we'll come back within one working day.
An Umbraco Silver Partner agency in Llandudno, North Wales and the Isle of Man, building and looking after Umbraco and .NET websites for businesses and agencies across the UK and beyond. Simon Antony is a brand of Simplepage Ltd.
Maesgwyn, 3 Claremont rd,
Llandudno, North Wales, LL30 2UF